Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
183 results · page 2 of 4
May 7, 2026An improper input validation, together with an overly permissive default CORS configuration in Open Notebook v1.8.1 allows remote attacker to trick a legitimateCVE-2026-28201 · Other software · Open Notebook · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158High 8.7
An improper input validation, together with an overly permissive default CORS configuration in Open Notebook v1.8.1 allows remote attacker to trick a legitimate user to alter or delete arbitrary database entries via specially crafted malicious URL. Depending on the deployment, data exfiltration is also possible.
- Product
- Open Notebook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2026Insufficient validation of untrusted input in CORS in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process toCVE-2026-7968 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comLow 3.1
Insufficient validation of untrusted input in CORS in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Apr 15, 2026Insufficient policy enforcement in CORS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to leak crosCVE-2026-6313 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comLow 3.1
Insufficient policy enforcement in CORS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Apr 8, 2026CORS misconfiguration in CoolerControl/coolercontrold <4.0.0 allows unauthenticated remote attackers to read data and send commands to the service via maliciousCVE-2026-5302 · Other software · CoolerControl · reported by cve@gitlab.comMedium 6.3
CORS misconfiguration in CoolerControl/coolercontrold <4.0.0 allows unauthenticated remote attackers to read data and send commands to the service via malicious websites
- Product
- coolercontrold
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026WP-CORS: Missing AuthorizationCVE-2026-25410 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in tstephenson WP-CORS wp-cors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-CORS: from n/a through <= 0.2.2.
- Product
- WP-CORS
- Affected
- up to 0.2.2
- What to do
- Affects up to 0.2.2. Update WP-CORS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 10, 2026Certain HP OfficeJet Pro printers may expose information if Cross‑Origin Resource Sharing (CORS) is misconfigured, potentially allowing unauthorized web originsCVE-2026-1997 · Other software · HP Inc · reported by hp-security-alert@hp.comMedium 6.9
Certain HP OfficeJet Pro printers may expose information if Cross‑Origin Resource Sharing (CORS) is misconfigured, potentially allowing unauthorized web origins to access device resource. CORS is disabled by default on Pro‑class devices and can only be enabled by an administrator through the Embedded Web Server (EWS). Keeping CORS disabled unless explicitly required helps ensure that only trusted solutions can interact with the device.
- Product
- HP OfficeJet Pro 8730 All-in-One Printer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2026Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) implement an insecure Cross-Origin Resource Sharing (CORS) policy on authenticateCVE-2026-24435 · Other software · Shenzhen Tenda Technology Co., Ltd. · reported by VulnCheckHigh 7.1
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) implement an insecure Cross-Origin Resource Sharing (CORS) policy on authenticated administrative endpoints. The device sets Access-Control-Allow-Origin: * in combination with Access-Control-Allow-Credentials: true, allowing attacker-controlled origins to issue credentialed cross-origin requests.
- Product
- W30E V2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtendacn.comvulncheck.com
Jan 19, 2026Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) policy that allowed credentialed cross-origin requCVE-2026-1181 · Other software · Altium · reported by 4760f414-e1ae-4ff1-bdad-c7a9c3538b79Critical 9
Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) policy that allowed credentialed cross-origin requests from other Altium-controlled subdomains, including forum.live.altium.com. As a result, JavaScript executing on those origins could access authenticated workspace APIs in the context of a logged-in user. When chained with vulnerabilities in those external applications, this misconfiguration enables unauthorized access to workspace data, administrative actions, and bypass of IP allowlisting controls, including in GovCloud environments.
- Product
- Altium 365
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026A CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in the Access-Control-AlCVE-2025-55462 · Other software · Eramba · reported by MITREMedium 6.5
A CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in the Access-Control-Allow-Origin response along with Access-Control-Allow-Credentials: true. This permits malicious third-party websites to perform authenticated cross-origin requests against the Eramba API, including endpoints like /system-api/login and /system-api/user/me. The response includes sensitive user session data (ID, name, email, access groups), which is accessible to the attacker's JavaScript. This flaw enables full session hijack and data exfiltration without user interaction. Eramba versions 3.23.3 and earlier were tested and appear unaffected. The vulnerability is present in default installations, requiring no custom configuration.
- Product
- Eramba
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscussions.eramba.org
Dec 18, 2025A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint.CVE-2025-63388 · Other software · Langgenius · reported by MITRECritical 9.1
A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint. The endpoint implements an overly permissive CORS policy that reflects arbitrary Origin headers and sets Access-Control-Allow-Credentials: true, allowing any external domain to make authenticated cross-origin requests. NOTE: the Supplier disputes this, providing the rationale of "sending requests with credentials does not provide any additional access compared to unauthenticated requests."
- Product
- Dify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Dec 18, 2025A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint.CVE-2025-63386 · Other software · Langgenius · reported by MITRECritical 9.1
A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint. The endpoint implements an insecure CORS policy that reflects any Origin header and enables Access-Control-Allow-Credentials: true, permitting arbitrary external domains to make authenticated requests. NOTE: the Supplier disputes this because the endpoint configuration is intentional to support bootstrap.
- Product
- Dify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Oct 2, 2025Incorrect Cross-Origin Resource Sharing (CORS) configuration in Hiberus Sintra.CVE-2025-41010 · Other software · Hiberus · reported by cve-coordination@incibe.esMedium 5.1
Incorrect Cross-Origin Resource Sharing (CORS) configuration in Hiberus Sintra. Cross-Origin Resource Sharing (CORS) allows browsers to make cross-domain requests in a controlled manner. This request has an “Origin” header that identifies the domain making the initial request and defines the protocol between a browser and a server to see if the request is allowed. An attacker can exploit this and potentially perform privileged actions and access confidential information when Access-Control-Allow-Credentials is enabled.
- Product
- Sintra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2025Rob--W cors-anywhere instances configured as an open proxy allow unauthenticated external users to induce the server to make HTTP requests to arbitrary targets CVE-2020-36851 · Other software · Rob--W / cors-anywhere · reported by VulnCheckCritical 9.5
Rob--W cors-anywhere instances configured as an open proxy allow unauthenticated external users to induce the server to make HTTP requests to arbitrary targets (SSRF). Because the proxy forwards requests and headers, an attacker can reach internal-only endpoints and link-local metadata services, retrieve instance role credentials or other sensitive metadata, and interact with internal APIs and services that are not intended to be internet-facing. The vulnerability is exploitable by sending crafted requests to the proxy with the target resource encoded in the URL; many cors-anywhere deployments forward arbitrary methods and headers (including PUT), which can permit exploitation of IMDSv2 workflows as well as access to internal management APIs. Successful exploitation can result in theft of cloud credentials, unauthorized access to internal services, remote code execution or privilege escalation (depending on reachable backends), data exfiltration, and full compromise of cloud resources. Mitigation includes: restricting the proxy to trusted origins or authentication, whitelisting allowed target hosts, preventing access to link-local and internal IP ranges, removing support for unsafe
- Product
- Rob--W / cors-anywhere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025An Origin Validation Error in the elysia-cors library thru 1.3.0 allows attackers to bypass Cross-Origin Resource Sharing (CORS) restrictions.CVE-2025-50864 · Other software · reported by MITREMedium 6.5
An Origin Validation Error in the elysia-cors library thru 1.3.0 allows attackers to bypass Cross-Origin Resource Sharing (CORS) restrictions. The library incorrectly validates the supplied origin by checking if it is a substring of any domain in the site's CORS policy, rather than performing an exact match. For example, a malicious origin like "notexample.com", "example.common.net" is whitelisted when the site's CORS policy specifies "example.com." This vulnerability enables unauthorized access to user data on sites using the elysia-cors library for CORS validation.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2025A CORS misconfiguration in Nginx Proxy Manager v2.12.3 allows unauthorized domains to access sensitive data, particularly JWT tokens, due to improper validationCVE-2025-50579 · Other software · Jc21 · reported by MITREMedium 5.3
A CORS misconfiguration in Nginx Proxy Manager v2.12.3 allows unauthorized domains to access sensitive data, particularly JWT tokens, due to improper validation of the Origin header. This misconfiguration enables attackers to intercept tokens using a simple browser script and exfiltrate them to a remote attacker-controlled server, potentially leading to unauthorized actions within the application.
- Product
- Nginx Proxy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2025IBM Concert Software 1.0.0 through 1.1.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain nCVE-2025-27909 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Concert Software 1.0.0 through 1.1.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain name is not being limited to only trusted domains.
- Product
- Concert Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2025In the Linux kernel, the following vulnerability has been resolved: hwmon: (corsair-cpro) Validate the size of the received input buffer Add buffer_recv_size CVE-2025-38548 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: hwmon: (corsair-cpro) Validate the size of the received input buffer Add buffer_recv_size to store the size of the received bytes. Validate buffer_recv_size in send_usb_cmd().
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 6, 2025Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) heaCVE-2025-47908 · Other software · github.com/rs/cors · reported by security@golang.orgHigh 7.5
Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.
- Product
- github.com/rs/cors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2025Thunderbird cached CORS preflight responses across IP address changes.CVE-2025-8036 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.1
Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Jun 6, 2025In IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04, a configuration error has been detected in cross-origin resource sharing (CORS).CVE-2025-41366 · Other software · ZIV · reported by cve-coordination@incibe.esMedium 5.1
In IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04, a configuration error has been detected in cross-origin resource sharing (CORS). Exploiting this vulnerability requires authenticating to the device and executing certain commands that can only be executed with permissions higher than the view permission.
- Product
- IDF and ZLF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2025In IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04, a configuration error has been detected in cross-origin resource sharing (CORS).CVE-2025-41363 · Other software · ZIV · reported by cve-coordination@incibe.esMedium 5.3
In IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04, a configuration error has been detected in cross-origin resource sharing (CORS). Exploiting this vulnerability requires authenticating to the device and executing certain commands that can be executed with view permission.
- Product
- IDF and ZLF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2025SEL-5037 Grid Configurator contains an overly permissive Cross Origin Resource Sharing (CORS) configuration for a data gateway service in the application.CVE-2025-46737 · Other software · Schweitzer Engineering Laboratories · reported by security@selinc.comHigh 7.4
SEL-5037 Grid Configurator contains an overly permissive Cross Origin Resource Sharing (CORS) configuration for a data gateway service in the application. This gateway service includes an API which is not properly configured to reject requests from unexpected sources.
- Product
- SEL-5037 Grid Configurator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2025Omnissa UAG contains a Cross-Origin Resource Sharing (CORS) bypass vulnerability.CVE-2025-25234 · Other software · Omnissa · reported by de5a6978-88fe-4c27-a7df-d0d5b52d5b52High 7.1
Omnissa UAG contains a Cross-Origin Resource Sharing (CORS) bypass vulnerability. A malicious actor with network access to UAG may be able to bypass administrator-configured CORS restrictions to gain access to sensitive networks.
- Product
- Omnissa Unified Access Gateway (UAG)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstatic.omnissa.comomnissa.com
Apr 1, 2025In the Linux kernel, the following vulnerability has been resolved: HID: corsair-void: Update power supply values with a unified work handler corsair_void_proCVE-2025-21952 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: HID: corsair-void: Update power supply values with a unified work handler corsair_void_process_receiver can be called from an interrupt context, locking battery_mutex in it was causing a kernel panic. Fix it by moving the critical section into its own work, sharing this work with battery_add_work and battery_remove_work to remove the need for any locking
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Mar 20, 2025A Cross-Origin Resource Sharing (CORS) vulnerability exists in modelscope/agentscope version v0.0.4.CVE-2024-8487 · Other software · modelscope · reported by security@huntr.devCritical 9.8
A Cross-Origin Resource Sharing (CORS) vulnerability exists in modelscope/agentscope version v0.0.4. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can lead to unauthorized data access, information disclosure, and potential further exploitation, thereby compromising the integrity and confidentiality of the system.
- Product
- modelscope/agentscope
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A CORS (Cross-Origin Resource Sharing) misconfiguration in prefecthq/prefect version 2.20.2 allows unauthorized domains to access sensitive data.CVE-2024-8183 · Other software · prefecthq · reported by security@huntr.devHigh 7.6
A CORS (Cross-Origin Resource Sharing) misconfiguration in prefecthq/prefect version 2.20.2 allows unauthorized domains to access sensitive data. This vulnerability can lead to unauthorized access to the database, resulting in potential data leaks, loss of confidentiality, service disruption, and data integrity risks.
- Product
- prefecthq/prefect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A CORS misconfiguration vulnerability exists in netease-youdao/qanything version 1.4.1.CVE-2024-8024 · Other software · netease-youdao · reported by security@huntr.devHigh 7.5
A CORS misconfiguration vulnerability exists in netease-youdao/qanything version 1.4.1. This vulnerability allows an attacker to bypass the Same-Origin Policy, potentially leading to sensitive information exposure. Properly implementing a restrictive CORS policy is crucial to prevent such security issues.
- Product
- netease-youdao/qanything
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A CORS misconfiguration in danswer-ai/danswer v1.4.1 allows attackers to steal sensitive information such as chat contents, API keys, and other data.CVE-2024-7819 · Other software · danswer-ai · reported by security@huntr.devHigh 7.4
A CORS misconfiguration in danswer-ai/danswer v1.4.1 allows attackers to steal sensitive information such as chat contents, API keys, and other data. This vulnerability occurs due to improper validation of the origin header, enabling malicious web pages to make unauthorized requests to the application's API.
- Product
- danswer-ai/danswer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025corydolphin/flask-cors version 4.01 contains a vulnerability where the request path matching is case-insensitive due to the use of the `try_match` function, whiCVE-2024-6866 · Other software · corydolphin · reported by security@huntr.devHigh 7.5
corydolphin/flask-cors version 4.01 contains a vulnerability where the request path matching is case-insensitive due to the use of the `try_match` function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but the regex matching treats them as case-insensitive. This misconfiguration can lead to significant security vulnerabilities, allowing unauthorized origins to access paths meant to be restricted, resulting in data exposure and potential data leaks.
- Product
- corydolphin/flask-cors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhuntr.comlists.debian.org
Mar 20, 2025A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths.CVE-2024-6844 · Other software · corydolphin · reported by security@huntr.devMedium 5.3
A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquote_plus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues.
- Product
- corydolphin/flask-cors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhuntr.comlists.debian.org
Mar 20, 2025corydolphin/flask-cors version 4.0.1 contains an improper regex path matching vulnerability.CVE-2024-6839 · Other software · corydolphin · reported by security@huntr.devMedium 5.3
corydolphin/flask-cors version 4.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex pattern priority allows unauthorized cross-origin access to sensitive data or functionality, potentially exposing confidential information and increasing the risk of unauthorized actions by malicious actors.
- Product
- corydolphin/flask-cors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhuntr.comlists.debian.org
Mar 20, 2025A Cross-Origin Resource Sharing (CORS) vulnerability exists in feast-dev/feast version 0.40.0.CVE-2024-11602 · Other software · feast-dev · reported by security@huntr.devHigh 7.4
A Cross-Origin Resource Sharing (CORS) vulnerability exists in feast-dev/feast version 0.40.0. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can bypass intended security controls and potentially expose sensitive information.
- Product
- feast-dev/feast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025In version 0.6.0 of eosphoros-ai/db-gpt, the `uvicorn` app created by `dbgpt_server` uses an overly permissive instance of `CORSMiddleware` which sets the `AcceCVE-2024-10906 · Other software · eosphoros-ai · reported by security@huntr.devHigh 8.1
In version 0.6.0 of eosphoros-ai/db-gpt, the `uvicorn` app created by `dbgpt_server` uses an overly permissive instance of `CORSMiddleware` which sets the `Access-Control-Allow-Origin` to `*` for all requests. This configuration makes all endpoints exposed by the server vulnerable to Cross-Site Request Forgery (CSRF). An attacker can exploit this vulnerability to interact with any endpoints of the instance, even if the instance is not publicly exposed to the network.
- Product
- eosphoros-ai/db-gpt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025In the Linux kernel, the following vulnerability has been resolved: HID: corsair-void: Add missing delayed work cancel for headset status The cancel_delayed_wCVE-2025-21797 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: HID: corsair-void: Add missing delayed work cancel for headset status The cancel_delayed_work_sync() call was missed, causing a use-after-free in corsair_void_remove().
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Feb 12, 2025A CWE-346 "Origin Validation Error" in the CORS configuration in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker tCVE-2025-1102 · Other software · Q-Free · reported by prodsec@nozominetworks.comMedium 5.5
A CWE-346 "Origin Validation Error" in the CORS configuration in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to affect the device confidentiality, integrity, or availability via crafted URLs or HTTP requests.
- Product
- MaxTime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024A CORS misconfiguration in parisneo/lollms-webui prior to version 10 allows attackers to steal sensitive information such as logs, browser sessions, and settingCVE-2024-6674 · Other software · parisneo · reported by security@huntr.devHigh 7.1
A CORS misconfiguration in parisneo/lollms-webui prior to version 10 allows attackers to steal sensitive information such as logs, browser sessions, and settings containing private API keys from other services. This vulnerability can also enable attackers to perform actions on behalf of a user, such as deleting a project or sending a message. The issue impacts the confidentiality and integrity of the information.
- Product
- parisneo/lollms-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2024A Cross-Site Request Forgery (CSRF) vulnerability exists in lunary-ai/lunary version 1.2.34 due to overly permissive CORS settings.CVE-2024-6862 · Other software · lunary-ai · reported by security@huntr.devHigh 8.1
A Cross-Site Request Forgery (CSRF) vulnerability exists in lunary-ai/lunary version 1.2.34 due to overly permissive CORS settings. This vulnerability allows an attacker to sign up for and create projects or use the instance as if they were a user with local access. The main attack vector is for instances hosted locally on personal machines, which are not publicly accessible. The CORS settings in the backend permit all origins, exposing unauthenticated endpoints to CSRF attacks.
- Product
- lunary-ai/lunary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2024A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default.CVE-2024-6221 · Other software · corydolphin · reported by security@huntr.devHigh 7.5
A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches, unauthorized access to sensitive information, and potential network intrusions.
- Product
- corydolphin/flask-cors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2024Gnuboard g6 6.0.7 is vulnerable to Session hijacking due to a CORS misconfiguration.CVE-2024-41475 · Other software · gnuboard · reported by MITREHigh 8.8
Gnuboard g6 6.0.7 is vulnerable to Session hijacking due to a CORS misconfiguration.
- Product
- gnuboard6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2024A CORS misconfiguration in the stitionai/devika repository allows attackers to steal sensitive information such as logs, browser sessions, and settings containiCVE-2024-5549 · Other software · stitionai · reported by security@huntr.devHigh 8.1
A CORS misconfiguration in the stitionai/devika repository allows attackers to steal sensitive information such as logs, browser sessions, and settings containing private API keys from other services. This vulnerability also enables attackers to perform actions on behalf of the user, such as deleting projects or sending messages. The issue arises from the lack of proper origin validation, allowing unauthorized cross-origin requests to be executed. The vulnerability is present in all versions of the repository, as no fixed version has been specified.
- Product
- stitionai/devika
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2024parseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g., https://example.community/* is allowed CVE-2019-25211 · Other software · gin-contrib · reported by MITRECritical 9.1
parseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g., https://example.community/* is allowed when the intention is that only https://example.com/* should be allowed, and http://localhost.example.com/* is allowed when the intention is that only http://localhost/* should be allowed.
- Product
- cors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2024A Cross-Site Request Forgery (CSRF) vulnerability exists in the XTTS server of parisneo/lollms version 9.6 due to a lax CORS policy.CVE-2024-4499 · Other software · parisneo · reported by security@huntr.devMedium 6.3
A Cross-Site Request Forgery (CSRF) vulnerability exists in the XTTS server of parisneo/lollms version 9.6 due to a lax CORS policy. The vulnerability allows attackers to perform unauthorized actions by tricking a user into visiting a malicious webpage, which can then trigger arbitrary LoLLMS-XTTS API requests. This issue can lead to the reading and writing of audio files and, when combined with other vulnerabilities, could allow for the reading of arbitrary files on the system and writing files outside the permitted audio file location.
- Product
- parisneo/lollms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2024CORSAIR iCUE 5.9.105 with iCUE Murals on Windows allows unprivileged users to insert DLL files in the cuepkg-1.2.6 subdirectory of the installation directory.CVE-2024-22002 · Other software · corsair · reported by MITREHigh 7.8
CORSAIR iCUE 5.9.105 with iCUE Murals on Windows allows unprivileged users to insert DLL files in the cuepkg-1.2.6 subdirectory of the installation directory.
- Product
- icue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2024Policy bypass in CORS in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to bypass discretionary access control via a crafted HTML page.CVE-2024-5840 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.5
Policy bypass in CORS in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
May 14, 2024HCL DRYiCE Lucy (now AEX) is affected by a Cross Origin Resource Sharing (CORS) vulnerability.CVE-2023-37526 · Other software · HCL Software · reported by psirt@hcl.comMedium 6.5
HCL DRYiCE Lucy (now AEX) is affected by a Cross Origin Resource Sharing (CORS) vulnerability. The mobile app is vulnerable to a CORS misconfiguration which could potentially allow unauthorized access to the application resources from any web domain and enable cache poisoning attacks.
- Product
- DRYiCE Lucy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcltechsw.comsupport.hcltechsw.com
Apr 19, 2024corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug.CVE-2024-1681 · Other software · corydolphin · reported by security@huntr.devMedium 5.3
corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files, potentially covering tracks of other attacks, confusing log post-processing tools, and forging log entries. The issue is due to improper output neutralization for logs.
- Product
- corydolphin/flask-cors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2024rack-cors (aka Rack CORS Middleware) 2.0.1 has 0666 permissions for the .rb files.CVE-2024-27456 · Other software · rack-cors_project · reported by MITRECritical 9.1
rack-cors (aka Rack CORS Middleware) 2.0.1 has 0666 permissions for the .rb files.
- Product
- rack-cors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2024IBM PowerSC 1.3, 2.0, and 2.1 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive infCVE-2023-50940 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM PowerSC 1.3, 2.0, and 2.1 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains. IBM X-Force ID: 275130.
- Product
- PowerSC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Dec 20, 2023Corsa: Unrestricted Upload of File with Dangerous TypeCVE-2023-23970 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Unrestricted Upload of File with Dangerous Type vulnerability in WooRockets Corsa.This issue affects Corsa: from n/a through 1.5.
- Product
- Corsa
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Corsa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 11, 2023@koa/cors npm provides Cross-Origin Resource Sharing (CORS) for koa, a web framework for Node.js.CVE-2023-49803 · Other software · koajs · reported by GitHubHigh 8.6
@koa/cors npm provides Cross-Origin Resource Sharing (CORS) for koa, a web framework for Node.js. Prior to version 5.0.0, the middleware operates in a way that if an allowed origin is not provided, it will return an `Access-Control-Allow-Origin` header with the value of the origin from the request. This behavior completely disables one of the most crucial elements of browsers - the Same Origin Policy (SOP), this could cause a very serious security threat to the users of this middleware. If such behavior is expected, for instance, when middleware is used exclusively for prototypes and not for production applications, it should be heavily emphasized in the documentation along with an indication of the risks associated with such behavior, as many users may not be aware of it. Version 5.0.0 fixes this vulnerability.
- Product
- cors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.